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O ■ Abstract 

(N ■ 

Motivated by the quantum algorithm in [MN051 for testing commutativity of black-box groups, we 

study the following problem: Given a black-box finite ring R — (ri, • • • , r^) where {ri, ^2, • • • , rfc} is 
an additive generating set for R and a multilinear polynomial f{xi , • • • , Xm) over R also accessed as a 

O^ i black-box function / : i?™ -^ R (where we allow the indeterminates xi,- ■ ■ , Xm to be commuting or 

noncommuting), we study the problem of testing if / is an identity for the ring R. More precisely, the 

rj i problem is to test if /(ai, a2, • • • , «„) = for all a^ e R. 

S^ ■ • We give a quantum algorithm with query complexity 0{m{l + Q;)™/^fc'"+i ) assuming fc > (1 + 

lyj I l/a)'"+^. Towards a lower bound, we also discuss a reduction from a version of m-collision to 

O . this problem. 

• We also observe a randomized test with query complexity A™mk and constant success probability 
and a deterministic test with k™ query complexity. 
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1 Introduction 



[~^ . For any finite ring {R, +, •) the ring R[xi,X2, • • • , Xm] is the ring of polynomials in commuting variables 

O I xi,X2,- ■ ■ , Xm and coefficients in R. The ring R{xi,X2, • • • , Xm} is the ring of polynomials where the 

--^ ' indeterminates Xj are noncommuting. By noncommuting variables, we mean XiXj — XjXi 7^ for i 7^ j. 

For the algorithmic problem we study in this paper, we assume that that the elements of the ring {R, +, •) 
are uniformly encoded by binary strings of length n and R = (ri,r2, • • • ,ryfc) is given by an additive 
/\ \ generating set {ri, r2, • • • , r^}. That is. 



R = {^ttirj I ai £ Z}. 

i 

Also, the ring operations of R are performed by black-box oracles for addition and multiplication that 
take as input two strings encoding ring elements and output their sum or product (as the case may be). 
Additionally, we assume that the zero element of R is encoded by some fixed string. We now define the 
problem which we study in this paper. 

The Multilinear Identity Testing Problem (MIT): The input to the problem is a black-box ring R = 

i^ii' " 7 ^k) given by an additive generating set, and a multilinear polynomial f{xi, • • • , Xm) (in the ring 
R[xi, • • • , Xm] or the ring R{xi, • • • , Xm}) that is also given by black-box access. The problem is to test if 
/ is an identity for the ring R. More precisely, the problem is to test if /(ai, 02, ■ ■ • , a^) = for all Cj G R. 



A natural example of an instance of this problem is the bivariate polynomial f{xi,X2) = X1X2 — 2;23;i 
over the ring R{xi,X2}. This is an identity for R precisely when i? is a commutative ring. Clearly, it 
suffices to check if the generators commute with each other which gives a naive algorithm that makes 0{k'^) 
queries to the ring oracles. 

Given a polynomial f{xi, • • • , Xm) and a black-box ring R by generators, we briefly recall some facts 
about the complexity of checking if / = is an identity for R. The problem can be NP-hard when the 
number of indeterminates m is unbounded, even when i? is a fixed ring. To see this, notice that a 3-CNF 
formula F(xi, • • • , Xn) can be expressed as a 0{n) degree multilinear polynomial f{xi,X2, • • • , x„) over 
F2, by writing F in terms of addition and multiplication over F2. It follows that / = is an identity for F2 
if and only if F is an unsatisfiable formula. 

We remark that a closely related problem is Polynomial Identity Testing (PIT). For PIT we ask whether 
the polynomial /(xi, • • • , Xm) is the zero polynomial, which is a stronger property. To see the difference, 
consider a standard example: For a prime p, notice that x^ — x = is an identity for Fp but x^ — x is not a 
zero polynomial in Fp [x] . However, when the ring R is afield F and the degree of / is smaller than the size of 
the field F then the two problems coincide as a consequence of the Schwartz-Zippel lemma LSchSOl Zip79 1. 
More precisely, / = is an identity for F if and only if / is the zero polynomial. 

When / is given by an arithmetic circuit then PIT is known to be in randomized polynomial time over 
fields HSchSOl Zip79] and even finite commutative rings with unity IIAB031IAMS08I . This is quite unlike 



MIT which can be NP-hard for polynomials over small fields as already observed above. 

On the other hand, when / is given by black-box access as a function / : i?™ — > R then there is no way 
to distinguish between the problems PIT and MIT. Algorithmically, they coincide. 

Over the years. Polynomial Identity Testing has emerged as an important algorithmic problem fAB03J 
IKI031. Due to its significance in complexity theory, PIT has been actively studied in recent years [1DSO6I 
|KS07,RS05]. 

In this paper we focus on the query complexity of multilinear identity testing (MIT). In our query model, 
each ring operation, which is performed by a query to the ring oracle, is of unit cost. Furthermore, we 
consider each evaluation of /(oi, • • • , am) to be of unit cost for a given input (oi, • • • , am) £ R^- This 
model is reasonable because we consider ?tt, as a parameter that is much smaller than k. 

Our goal is to find upper and lower bounds on the query complexity for the problem. We are interested 
in the query complexity for both classical and quantum computation. The main motivation for our study is 
a result of Magniez and Nayak in IIMN05 I. where the authors study the quantum query complexity of group 
commutativity testing: Let G be a finite black-box group given by a generating s&t gi,g2,- • • , Qk and group 
operations are performed by a group oracle. The algorithmic task is to check if G is commutative. For this 
problem the authors in IIMN05II give a quantum algorithm with query complexity 0{k'^l^ log k) and time 
complexity 0{k'^'^ log^ k). Furthermore a Vl{k'^i^) lower bound for the quantum query complexity is also 
shown. The main technical tool for their upper bound result was a method of quantization of random walks 
first showed by Szegedy IISze04ll . More recently, Magniez et al in IIMNRS071 discovered a simpler and 
improved description of Szegedy's method. 

Our starting point is the observation that the Magniez-Nayak result IIMN05II for group commutativity 
can also be easily seen as a commutativity test for arbitrary finite black-box rings. If i? = (ri, • • • , r^) is a 
finite black-box ring and / is the bivariate polynomial /(xi, X2) = X1X2 — X2X1 over the polynomial ring 
i?{xi, X2} (xi, X2 do not commute). Testing if / = is an identity for R is testing if R is commutative. 
It turns out that the Magniez-Nayak results can be easily adapted to obtain similar upper and lower bounds 
for the quantum query complexity of the problem. Motivated by this connection we study the problem 
of testing multilinear identities for any black-box ring. We crucially need the multilinearity condition to 



generalize a result of Pak llPakOOII to multilinear polynomials. Given a black-box group G = {gi,- ■ ■ ,gk) 
by a generating set, Pak shows in fPakOO] that it suffices to plug in random subproducts of the generators 
for variables g and h in the equation gh = hg to check for commutativity. Pak shows that for such random 
subproducts gh ^ hg with constant probability if G is nonabelian. If i? = (ri, • • • , r^) is a finite black- 
box ring given by an additive generating set, Pak's result can be easily modified to show the following: 
if we plug in random subsums of the generators ri, • • • , r^ for the variables xi and X2 in the polynomial 
X1X2 — X2X1, then for noncommutative rings R we will have X1X2 — ^2X1 / with constant probability. 
We prove a generalization of this property for any multilinear polynomial /(xi, • • • , Xm)- Then, using the 
Magniez-Nayak technique adapted suitably, we show a quantum algorithm for this problem with quantum 
query complexity 0(m(l + a)™' A;™+i ) when (1 + l/a)"*^ < k. 

For the lower bound result Magniez and Nayak show a reduction from UNIQUE COLLISION: let 
/ be a function from {1, 2, • • • , A;} to {1, 2, • • • , /c} given as a oracle, with the promise is that either 
there exists a unique collision pair x ^ y such that /(x) = f{y) or / is a permutation. It is known 
from earher work MAS 041 IKut05[ IAmb0 51 that the quantum query complexity of UNIQUE COLLISION is 
ri(A:^/^). In fact Magniez and Nayak define a variant of UNIQUE COLLISION problem, which they call 
UNIQUE SPLIT COLLISION problem: Assume k is even. Then, in the Yes instances, one element of the 
colliding pair has to come from {!,••• , k/2\ and the other from {k/2 + 1, • • • , /c}. Then their paper 
shows a reduction from UNIQUE COLLISION to UNIQUE SPLIT COLLISION and finally a reduction from 
UNIQUE SPLIT COLLISION to group commutativity testing. 

We show a reduction to a somewhat more general version of MIT from a problem that is closely related 
to the m-COLLISION problem studied in quantum computation. Given a function / : {1, 2, • • • , /c} -^ 
{1, 2, • • • , k} as an oracle and a positive integer m, the task is to determine if there is some element in the 
range of / with exactly m pre-images. More precisely, is there an i G [k] such that \f^^{i)\ = ml We define 
a new problem closely related to m-COLLISION problem, that we call m-SPLIT COLLISION problem. Here 
we divide the numbers 1, 2, • • • ,k into m consecutive equal-sized intervals (assume A; is a multiple of m) 
and ask if there is some element in the range of / with exactly one pre image in each of the m intervals. We 
show a reduction from m-SPLIT COLLISION to a general version of MIT. We do not know an explicit lower 
bound for the quantum query complexity of m-SPLIT COLLISION (unlike UNIQUE SPLIT COLLISION in 
IIMN05i ). The reduction of UNIQUE SPLIT COLLISION to group commutativity testing problem in [MN05] 
directly gives a Q.{k'^'^) lower bound for the quantum query complexity of the general version of MIT. 
However, we do not have a stronger lower bound. Ideally, we would like to have a dependence of m in the 
exponent of k. 

Our reduction from m-SPLIT COLLISION to MIT uses ideas from automata theory to construct a suit- 
able black-box ring. Recently, in IIAMS O8I we used similar ideas to give a new deterministic polynomial 
time identity testing (PIT) algorithm for arithmetic circuits computing sparse and small degree multivariate 
polynomial over noncommuting variables. 

Remark. Ambainis in IIAmb04 1 showed the quantum upper bound of 0(A;'"/'^+^) for the m-COLLISION 
problem. But VL{k'^/^) is the best known quantum lower bound for m-COLLISION for m = 2 IIAS04II . The 
quantum query complexity of m-COLLISION has been open for some years. 

There is a randomized reduction from m-COLLISION to m-SPLIT COLLISION with success probability 
e~^: let f : [k] ^ [k] be a 'yes' instance of m-COLLISION, and suppose f^^{i) = {ii,^2) • • • ,^m}- To 
reduce this instance to m-SPLIT COLLISION we pick a random m-partition /i , /2, • • • , /m of the domain [k] 
with each \Ij\ = k/m. Clearly, with probability e^™ the set {ii,i2,- ■ ■ ,«m} will be a split collision for 
the function /. Consequently, showing a quantum lower bound of Q.{k°') for m-COLLISION will imply a 
quantum lower bound of Q.{k'^/e'^) for m-SPLIT COLLISION and hence to MIT. 



2 Black-box rings and the quantum query model 

As already explained, the ring operations (addition and multiplication) for a black-box ring are performed by 
querying a ring oracle. We can modify the definition of black-box ring operations by making them unitary 
transforms that can be used in quantum algorithms. For a black-box ring R, we have two oracles O^ and O^ 
for addition and multiplication respectively. For any two ring elements r, s, and a binary string t G {0, 1}" 
we have 0^|r)|s) = |r)|r + s) and 0^|r)|s)|t) = |r)|s)|rs © t), where the elements of i? are encoded as 
strings in {0, 1}". Notice that O^ is a reversible function by virtue of {R, +) being an additive group. On 
the other hand, {R, •) does not have a group structure. Thus we have made O]^ reversible by defining it as 
a 3-place function O^ : {0, 1}^" — > {0, 1}^". When r or s do not encode ring elements these oracles can 
compute any arbitrary string. 

The query model in quantum computation is a natural extension of classical query model. The basic 
difference is that a classical algorithm queries deterministically or randomly selected basis states, whereas a 
quantum algorithm can query a quantum state which is a suitably prepared superposition of basis states. For 
a black-box ring operation the query operators are simply O^ and O^ (as defined above). For an arbitrary 
oracle function F : X —> Y, the corresponding unitary operator is Op '■ \g)\h) — > \g)\h © F{g)). In the 
query complexity model, we charge unit cost for a single query to the oracle and all other computations are 
free. We will assume that the input black-box polynomial / : R^ -^ Ris given by such an unitary operator 

All the quantum registers used during the computation can be initialised to |0). Then a fc-query 
algorithm for a black-box ring is a sequence of k + 1 unitary operators and k ring oracle operators: 
Uq, Qi, Ui,- ■ ■ , Uk-i, Qk, Uk where Qi G {O^, O^, Op} are the oracle queries and fj's are unitary opera- 
tors. The final step of the algorithm is to measure designated qubits and decide according to the measurement 
output. 

3 Quantum Algorithm for multilinear Identity Testing 

In this section we describe our quantum algorithm for multilinear identity testing MIT. Our algorithm is 
motivated by (and based on) the group commutativity testing algorithm of Magniez and Nayak IIMN05II . We 
briefly explain the algorithm of Magniez and Nayak. Their problem was the following: given a black-box 
group G by a set of generators gi,g2,- " ^gk^ the task is to find nontrivial upper bound on the quantum query 
complexity to determine whether G is commutative. The group operators (corresponding to the oracle) are 
Og and Oq-i. 

Note that for this problem, there is a trivial classical algorithm (so as quantum) of query complexity 
0{k'^). In an interesting paper Pak showed a classical randomized algorithm of query complexity 0{k) for 
the same problem UPakOOl . Pak's algorithm is based on the following observation (Lemma 1.3 in UPakOOII ): 
consider a subproduct h = g\^g^ • ■ ■ g'fJ' where e^' s are picked uniformly at random from {0, 1}. Then for 
any proper subgroup H of G, Prob[h H] > 1/2. 

One important step of the algorithm in IIMN05II is a generalization of Pak's lemma. Let Sg be the set of all 

distinct element i tuples of elements from {1, 2, • • • , k}. For u = (ui, • • • , ue), define gu = gui ■gu2 ' ' ' guf 
T t ^ e(e-i)+(k~mk-e-i) 

" k{k—l) 

Lemma 3.1 l[MN05\l For any proper subgroup K ofG, ProbugSffeu K] > i^ 

As a simple corollary of this lemma, Magniez and Nayak show in IIMN05I that if G is nonabelian then for 
randomly picked u and v from Sg the elements gu and g^ will not commute with probability at least ^ "F' . 



Thus, for noncommutative G there will be at least '■ ~^' fraction of noncommuting pairs (n, v). Call such 
pairs as "marked pairs". Next, their idea is to do a random walk in the space of all pairs and hit a marked pair 
quickly (i.e. using only a few queries to the group oracle). They achieved this by defining a random walk 
and quantizing it using ISze04, MNRS07II . The random walk consists of two independent random walks on 
S(,. For each u G Si, they maintain a binary tree tu whose leaves corresponds to Qu-^ , Qu^ , • • • ^Qu^, and the 
internal nodes corresponds to the group product of its two children. So Qu is computed at the root of tu- The 
description of the random walk is simple. Suppose the state is u G 5^ at some stage. With probability 1/2 
the walk will stay at u (this ensures the ergodicity of the walk) and with probability 1/2 do the following: 
Pick i uniformly at random from 1 , 2 , • • • ,t and pick j uniformly at random from 1 , 2 , • • • , A; . If j is already 
equal to some Um, exchange ui and Um. Otherwise set Ui = j. Recompute the group operations at the nodes 
of tu which are affected by this substitution. It is easy to see that tu can be updated using only 0{log£) 
queries to group oracle. Using a coupling argument of Markov Chain it is shown in [MN05I that the spectral 
gap 6 of this random walk is at least g^^j^— £■ Since the random walk is ergodic its stationary distribution 

will be uniform. So the fraction of the marked states (pairs) in Si x Se will be at least ^ ~f' . Now they 
invoke Szegedy's result to perform a quantum walk on Si x Si and hit a marked element pair. We recall the 
statement of Szegedy's theorem. (For a detailed explanation see the section 2.3 of liMN05il ) 

Theorem 3.2 l\Sze04]l Let P be the transition matrix of a Markov Chain on a graph G = (V, E) and 5 be 
the spectral gap of P. Also let M be the set of all marked vertices in V and \M\/\V\ > e > 0, whenever 
M is nonempty. Then there is a quantum algorithm which determines whether M is nonempty with constant 
success probability and query complexity S + 0{{U + C) / \/5e). S is the setup cost of the quantum process, 
U is the update cost for one step of the walk and C is the checking cost 

The set up cost of the Magniez-Nayak algorithm is 2(^—1) and update cost is 0(log k). Combined with 
Szegedy's theorem, some calculation shows that the query cost is minimized at ^ = k"^'^ and the quantum 
query complexity is 0{k'^/^ log k). 

3.1 Multilinear identity testing (MIT) 

Now we are ready to describe our result for multilinear identity testing for a given black-box ring. We 
start with describing the problem first. Let i? be a black-box ring given by a set of additive generators 
{^ii ''2, • • • , fk} and f{xi,X2, • • • , Xm) over Rhea multilinear polynomial also given by a black-box. Our 
problem is to test whether /(ai, • • • , am) = for all Oj G R. 

The first step is a suitable generalization of Pak's lemma. For any i G [m] , consider the set Ri '^ R 
defined as follows: 



Ri = {ue R\ V(6i,--- ,6,j_i,&i+i,--- ,hm) G R"^ \/(6i,--- ,6i_i,u, &j+i,--- ,hm) = 0} 

Clearly, if / is not a zero function from R"^ —>■ R, then \Ri\ < \R\. In the following lemma, we prove 
that if / is not a zero function then \Ri\ < \R\/2. 

Lemma 3.3 Let R be any finite ring and f{xi,X2, ■ ■ ■ , Xm) be a multilinear polynomial over R (commuting 
or noncommuting) such that f = is not an identity for R. For i G [m] define 

Ri = {u£ R\y{bi,--- M~iA+ir-- ,bm) G i?™"\ /(6i, • • • ,bi-i,u,bi+i,- ■ ■ ,bm) = 0}. (1) 
Then Ri is an additive coset of a proper additive subgroup of Rand hence \Ri\ < |^|/2- 



Proof. Write / = A{xi,--- ,Xi-i,Xi,Xi+i,- ■ ■ ,Xrn) + B{xi,--- ,Xj_i,Xi+i, • • • ,Xm) where A is the 
sum of all the monomials of / containing x, and B is the sum of the rest of the monomials. Let fi, U2 
be any two distinct elements in Ri. Then for any fixed y = {yi, • • • , yj_i, yj+i, • • • , ym) G R"^~^, con- 
sider the evaluation of A and B over (yi, • • • , yj-i, wi, yj+i, • • • ,ym) and (yi, • • • , yi-i,V2,yi+i, ■■■ ,ym) 
respectively. For convenience, we abuse the notation and write, 

A{vi,y) + B{y) = A{v2,y) + B{y) = 0. 

y is an assignment to xi, X2, • • • , Xj_i, Xj+i, • • • , x^ and vi, V2 are the assignments to Xj respectively. Note 
that, as / is a multilinear polynomial, the above relation in turns implies that A{vi — V2,y) = 0. 
Consider the set Ri, defined as follows: fix any u^'-^ G R^. 

R^ = {x- u^) \x&Ri} 

We claim that Ri is an (additive) subgroup of R. We only need to show that Ri is closed under the addition 
(of R). Consider (xi - u^), (x2 - n^*)) G Ri. Then (xi - u^^) + (x2 - n^*)) = (xi + X2 - u^^) - u^'\ It 
is now enough to show that for any y G R"^^^, /(xi + X2 — u^^\y) = (xi + X2 + n*^*^ is an assignment 
to Xi). Again using the fact that / is multilinear, we can easily see the following: 

f{xi+X2-u^'\y) = A{xuy)+A{x2,y)-A{u^'\y)+B{y) = A{x2,y)-A{u^'\y) = A{x2-u^'\y) = 0. 

Note that the last equality follows because X2 and u are in Ri. Hence we have proved that Ri is a subgroup 
of R. So Ri = Ri + n*-*^ i.e Ri is a coset of Ri inside R. Also \Ri\ < \R\ (/is not identically zero over R). 
Thus, finally we get \Ri\ = \Ri\ < \R\/2. ■ 



Our quantum algorithm is based on the algorithm of IIMN05I . In the rest of the paper we denote by S^ the 
set of all £ size subsets of { 1 , 2, • • • ,k}\!i We follow a quantization of a random walk on S"^ x • • • x 5"^ = S^. 
For u = {ui,U2,- ■ ■ tUc}, define r„ = r„^ + ■ • • + r^^. Now, we suitably adapt the Lemma 1 of IIMN05II 
in our context. Let i? be a finite ring given by a additive generating set S = {ri, • • • , r^}. W.l.o.g, assume 
that ri is the zero element of R. Let Rbea. proper additive subgroup of {R, +). Let j be the least integer in 
[k] such that rj R. Since i? is a proper subgroup of R, such a j always exists. 

Lemma 3.4 Let R < R be a proper additive subgroup of R and T be an additive coset of R in R. Then 

Prob^.sjr, T] > i^, ^herep= '^'-'^%!f-'-'\ 

Proof. Let j be the least integer in [k] such that rj R. Since i? is a proper subgroup of R, such a j always 
exists. Fix a set u of size i. such that 1 G n and j u. Denote by v the set obtained from u by deleting 1 and 
inserting j. This define a one to one correspondence (matching) between all such pair of (n, v). Moreover 
fv = fu + i"j (notice that ri = 0). Then at least one of the element r^ or r^ is not in T. For otherwise 
{fv — ru) G i? implying rj G R, which is a contradiction. 
Therefore, 

Probues, [ru G T I j G u xor 1 G u] < -. 



' Notice that in fMN05|, the author consider the set of all £ tuples instead of subsets. This is important for them as they work in 
nonabelian structure in general (where order matters). But we will be interested only over additive abelian structure of a ring and 
thus order does not matter for us. 



For any two indices i,j, 

'{e-i) + (k-e){k-e-i) 



ProbuesJiJ e uorij 0u] 



k(k-l) 

Thus, 

Proves, [ru G T] < (1 - p)/2 + p < (1 + p)/2. 

This completes the proof. ■ 

Let T = Ri in Lemma l34l where Ri is as defined in Lemma [331 

Suppose / = is not an identity for the ring R. Then, using Lemma [T4l we show for ui, ii2, • ' ' > ^m 
picked uniformly at random from Se that f{rui, • • • , ^u^) is non zero with non-negligible probability. This 
is analogous to ||MN05[ Lemma 2]. 

Lemma 3.5 Let f{xi, ■ ■ ■ , x^) be a multilinear polynomial (in commuting or noncommuting indetermi- 
nates) over R such that f = is not an identity for the ring R. Then, 

Probui,...,un,esJf(rui,--- ,ru„J / 0] > ' 



Proof. For i G [m], let Ri be the additive coset defined in Equation [T] of Lemma [331 The proof is by 
simple induction on m. The proof for the base case of the induction (i.e for m = 1) follows easily from the 
definition of Ri and Lemma [33] By induction hypothesis assume that the result of this lemma holds for all 
t-variate multilinear polynomials g such that (7 = is not an identity for R with t < tti — 1. 

Consider the given multilinear polynomial f{xi,X2, • • • , Xm)- Then by the Lemma [331 Rm is a coset 
of an additive subgroup Rm inside R. Pick Um S S^ uniformly at random. If / = is not an identity 
on R then by Lemma \TA\ we get r^^ Rm with probability at least —^. Let g{xi,X2, ■ ■ ■ ,Xm-i) = 
/ (xi , • • • , Xm- 1 , Turr, ) ■ Since r^^ Rm with probability at least —^ , it follows that g = Ois not an identity 
on R with probabihty at least -^. Then, by induction hypothesis, Probm,... ,u,n-ieSf [g(i^ui , • • • ; ^^um_i) / 



m— 1 



0] > (^2^) . Hence we get, Probui,...,u„,GS,[f(rui,--- ,run,) 7^ 0] > (^) , which proves the 



lemma. ■ 

We observe two simple consequences of Lemma [331 Notice that -^ = uj^Zi) - Letting £ = 1 we get 

-^ = 1/k, and Lemma [331 implies that if / = is not an identity for R then /(ai, • • • , am) 7^ for one 
of the fc™ choices for the Cj from the generating set {ri, • • • , r^}. 

Corollary 3.6 There is a deterministic k"^ query algorithm for MIT, where f is m-variate and R is given 
by an additive generating set of size k. 

Letting I = k/2 in Lemma [331 we get -^ > 1/4. Hence we obtain the following randomized test 
which makes A"^mk queries. 

Corollary 3.7 There is a randomized A"^mk query algorithm for MIT with constant success probability, 
where f is m-variate and R is given by an additive generating set of size k. 

Remark. Corollarv l3.6| can be seen as a generalization of the k'^ query deterministic test for commutativity. 
Likewise, Corollary I3.7l is analogous to Pak's 0{k) query randomized test for commutativity. 



We use Lemma l33] to design our quantum algorithm. Our quantum algorithm is based on a quantization 
of a random waUc on S™ and motivated by the one described in IIMN05I . The Lemma [375] is used to guarantee 

that there will at least ( —^^ J fraction of marked points in the space S"^ i.e the points where / evaluates 
to non zero. 

Now we describe the random walk on S"^ which is the main building block of our quantum algorithm. 
In fact we only describe the random walk on Si. Over 5^, the random walk consists of just m independent 
simultaneous random walks on Si. 

3.1.1 Random walk on Sg 

Our random walk can be described as a random walk over a graph G = (V, E) which we define as follows: 
The vertices of G are all possible l subsets of [/c]. Two vertices are connected by an edge whenever the 
corresponding sets differ by exactly one element. Notice that G is a connected i(k — £) -regular graph. 
Also G is well known in the literature as Johnson Graph (with parameter {k,(,,i — 1)) IIBCN89II . Let P 
be the normalized adjacency matrix of G with rows and columns are indexed by the subsets of [k]. Then 
PxY = 1/^(A; — ^) if |X n y| = £ — 1 and otherwise. It is well known that the spectral gap J of P 
(,5 = 1 - A, where A is the second largest eigenvalue of P) is Q,{l/tj for i. < k/2 IIBCN89II . Now we 
describe the random walk on G. 

Let the current vertex is u = {ui,U2, • • • , uc} and r^ = r^^ + r^j + ••• + ?'«<,■ With probability 1/2 
stay at u and with probability 1/2 do the following: randomly pick Ui ^ u and j G [k] \ u. Then move to 
vertex v such that v is obtained from u by removing Ui and inserting j. Compute r^ by simply subtracting 
r„. from r^ and adding rj to it. That will only cost 2 oracle access. Staying in any vertex with probability 
1/2 ensures that the random walk is ergodic. So the stationary distribution of the random walk is always 
uniform. It is easy to see that the transition matrix of the random walk is yl = (/ + P)/2 where / is the 
identity matrix of suitable dimension. So the spectral gap of the transition matrix yl is J = (1 — A)/2 = 5/2. 

Now, in the following theorem we present the analysis of the query complexity. 

Theorem 3.8 Let R be a finite ring given as an oracle and f{xi, ■ ■ ■ , Xm) be a multilinear polynomial 
over R given as a black-box. Moreover let {ri, • • • , r^} is a given additive generating set for R. Then the 

fry )?T. -, 

quantum query complexity of identity testing of f is 0{m{l + a)'"' fc^+i ) assuming /c > (1 + l/a)™""^ . 

Proof. Our algorithm analysis is similar to the analysis of IIMN05II . 

Setup cost(S): For the quantum walk step we need to start with an uniform distribution on S^. With 
each u G 5^, we maintain a quantum register \du) that computes r^. So we need to prepare the following 
state 1^): 

It is easy to see that to compute any r^ we need I — 1 oracle access to the ring oracle. Since in each 
of m independent walk, quantum queries over all choices of u will be made in parallel (using quantum 
superposition), the total query cost for setup is m{l — 1). 

Update cost(U): It is clear from the random walk described in the section |3^1.1[ that the update cost over 
Si is only 2 oracle access. Thus for the random walk on S^ which is just m independent random walks, one 
on each copy of S^, we need a total update cost 2?n,o 



^In IMN05I the underlying group operation is not necessarily commutative (it is being tested for commutativity). Thus the 
update cost is more. 



Checking cost(C): To check whether / is zero on a point during the walk, we simply query the oracle 
for / once. 

Recall from Szegedy's result IISze04ll (as stated in Theorem I3.2I ). the total cost for query complex- 

ity is Q = S -\ 7^{U + C) where e = I -^ I is the proportion of the marked elements and 6 

is the spectral gap of the transition matrix A described in section 13.1.11 Combining together we get, 



Q < m 



(^-1) + 



From the random walk described in the section [3. 1.1[ we know that 6 > ^. 



Hence, Q < m 
Q < m 



(^-1) + 



3V2I 
TFT 

(£ - 1) + 3^/2fc'"/2 i 



Notice that, ^ 



i-p 



i I TZT j ■ Substituting for ^ we get. 






1/2 



We will choose a suitably small a > so that 



fc-i 



<1 + a. 



Then we can upper bound Q as follows. Q < m 

is to minimize Q with respect to £ and a. For that we choose 
the analysis. Substituting i 



1)+ 3^/2 -(1 + 0)^/2^-/2^ 
t 



. Now our goal 



: k where we will fix t appropriately in 
k^ we get, Q <m \{k^ - 1) + 3^/2 • (1 + a)W2^i/2fc '"~'T"''' 



Choosing 

t = {m/{m + 1)), we can easily see that the query complexity of the algorithm is 0{m{l + q)™/ /c™+i ). 



fc-i 



Finally, recall that we need choose an a > so that ^^^^ < 1 + a. Clearly, it suffices to choose a so 
that (1 + a)l < ak. Letting £ = /c'^/'^+i we get the constraint (1 + l/a)'"+^ < k which is satisfied if 



Remark. The choice of a in the above theorem shows some trade-offs in the query complexity between 
the parameters k and m. For constant m notice that this gives us an 0(fc™/"^+^) query upper bound for the 
quantum algorithm. 



Finally, it is easy to observe that the quantum algorithm and its analysis given in Theorem 
a more general problem stated in the following theorem. 



hold for 



Theorem 3.9 Let R be a black-box finite ring given by ring oracle and suppose A = {ri,r2,- ■ ■ ^r^) is 
an additive subgroup of R given by generators ri £ R. Let /(xi, X2, • • • , Xm) be a black-box multilinear 
polynomial f : R"^ -^ R. There is a quantum algorithm with query complexity 0{m{l + aV^' fc^+i) 
(assuming /c > (1 + l/a)*""^^ j, to check if f = is an identity for the additive abelian group Ajj 



4 A reduction from m-sPLix collision problem 

We can easily show that any classical algorithm for the MIT problem must make Q{k) queries. This is an easy 
consequence of observations in I.MN 05I. Specifically, an Q{k) is shown in [.MN05 |for commutativity testing 
of a black-box group G given by k generators. It is a consequence of the randomized query complexity for 
the UNIQUE SPLIT COLLISION problem. The lower bound argument apphes to MIT as well, implying an 
Q{k) query lower bound for the problem. 

We do not have an explicit lower bound result for the quantum query complexity of multilinear iden- 
tity testing problem (MIT) on rings. However, in this section we show that the more general problem 



''i.e. checking if /(ai, • • • , am) = for all a^ £ A. 



of multilinear identity testing for additive subgroups (described in Theorem 13.91 ) is at least as hard as 
m-SPLIT COLLISION, which is a version of the m-COLLISION problem. 
We first describe some automata theory that is useful for our reduction. 

4.1 Automata theory background 

We recall some standard automata theory notation (see, for example, IIHU78I ). Fix a finite automaton 
A = {Q, S, 6, qo,qf) which takes as input strings in S*. Q is the set of states of A, S is the alphabet, 6 : 
Q X S — > Q is the transition function, and qq and qf are the initial and final states respectively (throughout, 
we only consider automata with unique accepting states). For each letter 6 G S, let (5{, : Q ^ Q be the 
function defined by: 6b{q) = 6{q, b). These functions generate a submonoid of the monoid of all functions 
from Q to Q. This is the transition monoid of the automaton A and is well-studied in automata theory: for 
example, see [Str94. page 55]. We now define the 0-1 matrix Mf, £ fI'^I^I'^I as follows: Mb{q, q') = 1 if 
^h{q) = q' ^ and otherwise. 

The matrix M}, is simply the adjacency matrix of the graph of the function 5b- As the entries of M^ are 
only zeros and ones, we can consider Mb to be a matrix over any field F. 

Furthermore, for any w = wiW2- ••Wk G S* we define the matrix Af^ to be the matrix product 
Mw^Mw^ ■ ■ ■ Mwf.- If w is the empty string, define M^ to be the identity matrix of dimension \Q\ x \Q\. 
For a string w, let 5w denote the natural extension of the transition function to w; if w is the empty string, 5w 
is simply the identity function. It is easy to check that: M^iq, q') = 1 if 5w{q) = q' and otherwise. Thus, 
Mw is also a matrix of zeros and ones for any string w. Also, M^{qQ, qj) = 1 if and only if w is accepted 
by the automaton A. We now describe the reduction. 

Theorem 4.1 The m-SPLIT COLLISION problem reduces to multilinear polynomial identity testing (MITj 
for additive subgroups of black-box rings. 

Proof. An instance of m-SPLIT COLLISION is a function f -.[k] ^ [k] given as an oracle, where we assume 
w.l.o.g. that k = nm. Divide {1, 2, • • • , k} into m intervals /i, I2, • • • , Im, each containing n consecutive 
points of [k]. Recall that / has an m-coUision if for some j E [k] we have \f~^{j)\ = rn. Furthermore, / is 
said to have an m-split collision if for some j G [k] we have \f~^{j)\ = m and |/^^(j) n /i| = 1 for each 
interval /j. 

Consider the alphabet S = {6, c, 61, 62, • " " ) ^m}- For each i G [k], define the /c-tuple rj over S as 
follows: ri[i\ = b and ?"«[/(*)] = bj where i G Ij. For an index s G [A;] \ {i, f{i)} define ri[s] = c. 

Let A = {Q, S, 6, qo,qf) be a deterministic finite state automaton that accepts all strings tD G S* such 
that each bj,l < j < m occurs at least once in w. It is easy to see that such an automaton with a single 
final state qf can be designed with total number of states \Q\ = 2'^^'") = t. W.l.o.g. let the set of states Q 
be renamed as {1, 2, • • • , t}, where 1 is the initial state and t is the final state. 

For each letter a £ T,, let Ma denote the t x t transition matrix for 6a (as defined in Section l4n ). Since 
each Ma is a t x t 0-1 matrix, each Ma is in the ring .Mt{¥2) of t x t matrices with entries from the field 
F2. Let R denote the A;-fold product ring {Ait{¥2))^. Clearly, i? is a finite ring (which is going to play the 
role of the black-box ring in our reduction). We now define an additive subgroup T of R, where we describe 
the generating set of T using the m-SPLIT COLLISION instance /. 

For each index i G [k], define an /c-tuple Tj G i? as follows. Let Ti[i] = Mb, Tj[/(i)] = M^ (where 
i G Ij) and for each index s {i, f{i)} define Ti[s] = Ale. The additive subgroup of R we consider is 
T = (Ti, r2, • • • , Tfc) generated by the Ti,l<i<k. 

Furthermore, define two t x t matrices A and B in M-t{^2) as follows. Let A[l, 1] = 1 and A[u, £] = 
for {u, I) / (1, 1). For the matrix B, let B[t, 1] = 1 and B[u, ^] = for (u, I) / (t, 1). 

10 



Claim 4.2 Let w = wiW2 ■ ■ ■ wt & Ti* be any string. Then the automaton A defined above accepts w if and 
only if the matrix AM^iM^j^ ■ ■ ■ M^^B is nonzero. 

Proof of Claim By definition of the matrices Ma, the (1, kf^ entry of the product Mw^Mw^ ■ ■ ■ M^j^ is 1 if 
and only if w is accepted by A. By definition of the matrices A and B the claim follows immediately. 

Now, consider the polynomial P{xi,X2, • • • , Xm) in noncommuting indeterminates xi, • • • , Xm with 
coefficients from the matrix ring R defined as follows: 

P(xi, X2, • • • , Xm) = AxiX2 ■ ■ ■ XmB , 

where A = {A, A, . . . , A) ^ R and B = {B,B,- ■ ■ ,B) e Rare fc-tuples of A'& and B's respectively. We 
claim that the multilinear polynomial P{xi, X2, • " " ) ^m) = is an identity for the additive subgroup T if 
and only if / has no m-split collision. 

Claim 4.3 P{xi, ■ ■ ■ , Xm) = is an identity for the ring T = (Ti, • • • , T^) if and only if f has no m-split 
collision. 

Proof of Claim Suppose / has an ?TT,-split collision. Specifically, let ij G /j 1 < j < m be indices such that 
/(ii) = • • • = f{im) = (-■ In the polynomial P, we substitute for indeterminate Xj by Tj for I < j < m. 
Consider the product M = Ti^- ■ ■ Ti^ in the ring T. This product is an A;-tuple of t x t matrices such that in 
the l^^ component M has the matrix HSii ^fot where it G It. Since hi^bi^ ■ ■ ■ bi^ € S* is a length ?n,-string 
containing all the 5j's it will be accepted by the automaton A. Consequently, the {qo^qf)*^ entry of the 
matrix M, which is the (1, A;)*^ entry, is 1 (as explained in Section |4~T] ). It follows that the (1, 1) entry of 
the matrix AMB is 1. Hence P = is not an identity over the ring T. 

For the other direction, assume that / has no ?n,-split collision. We need to show that P = is an identity 
for the ring T. For any m elements ^i, 5*2, •• • ,Sm S T consider P{Si, ^2, • • • , Sm) = AS1S2 ■ ■ ■ SmB. 
Since Each Sj is an F2-linear combination of the generators Ti, • • • , T^, it follows by distributivity in the 
ring R that P{Si , 82,- " ; ^m) is an F2-linear combination of terms of the form P{Tk^ , T^j , • ■ ■ ; Tk^ ) ^^^ 
some m indices /ci , • • • ,km G [k]. Thus, it suffices to show that P{Tk^ , T^^ ■,•■■, T^^ ) = 0. 

Let f = n.n, ■■■n^. Then, for each j G [k] we have f\j] = T^, [j]Tk, [j] • • • T^^ [j]. Since / has 
no ?n,-split collision, for each j G [A'^] the set of matrices {Mf,-^ , M^j , • • • , Mf,^ } is not contained in the set 
{Ti [j] , r2 [j] , • • • , Tk [j]}. Thus, f[j] = n, [j\Tk, [j] • • • n^ [j] is a product of matrices M^, M^, ■ ■ ■ M^^ 
for a word w = W1W2 ■ ■ ■ Wm that is not accepted by A. It follows from the previous claim that AT[j]B = 0. 
Hence P{Tk^ , T^^ , • " " ) ^fc™ ) = which completes the proof. ■ 

Acknowledgment. We thank Ashwin Nayak for comments and suggestions. 
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